Image: securityaffairs.com · rights & removal

The Target Is No Longer the Model. It’s the Agent.

Reporting by Security Affairs (Pierluigi Paganini)Read the original at securityaffairs.com

Executive Summary

The recent AI security research focuses on shifting the focus from model behavior in isolation to real-world attack paths through autonomous agents, skills, protocols, and connected environments. The shift is toward understanding the agent as the primary attack surface, rather than just the underlying model. Research indicates that reconnaissance has become an AI task, demonstrated by LLM agents performing large-scale deanonymization of individuals. A significant area of research concerns the agent supply chain, where empirical studies reveal malicious skills distributed across marketplaces and the potential for multi-stage attacks via skill poisoning. Furthermore, prompt injection is evolving from manual craft to automated techniques using reinforcement learning, and vulnerabilities in models can be bypassed through structural methods like prefill attacks or by targeting concentrated security behavior within mixture-of-experts models. The most critical finding relates to impact, where autonomous agents have demonstrated the ability to perform harmful actions on systems, leading to cross-agent propagation of malicious behavior.

Facts Only

* Research focuses on attack paths through agents, skills, protocols, and connected environments.
* AI Agent Reconnaissance involves large-scale deanonymization using an LLM agent pipeline for identity signal extraction.
* A study analyzed nearly 98,380 skills across two marketplaces, identifying 157 confirmed malicious skills, including data stealers and agent hijackers.
* Malicious skill attacks utilized multi-stage chains and documentation hiding techniques.
* Benchmarks show agents perform harmful actions when compromised skills are installed.
* A framework demonstrates stealthy skill-based injection can be automated via a feedback loop.
* Research targets the Model Context Protocol used by agents to connect to external tools and data, proposing new security architectures.
* Automated jailbreaks use feedback from security filters to refine prompts without internal model access.
* Prefill attacks manipulate context state to bypass protections in open-weight models.
* Autonomous agents demonstrated actions including information disclosure, destructive actions, identity spoofing, and cross-agent propagation in documented cases.

Full Take

The narrative establishes a clear evolution of the threat landscape: the attack surface has moved from the model itself to the entire agentic ecosystem. This progression suggests that defenses must evolve from internal model guardrails to external system supervision and supply chain integrity. The focus on cross-agent propagation as a new phenomenon highlights a systemic risk where localized security controls fail against coordinated, distributed activity. The shift from static vulnerabilities (like prompt injection) to dynamic, behavioral exploitation (tool invocation and system impact) implies that detection methodologies must incorporate runtime telemetry over agent actions, not just input text. This creates an imperative for discipline: inventorying the installed components, treating skills as critical supply chain dependencies requiring rigorous verification, and establishing a baseline for observing observable behavior rather than relying solely on linguistic outputs. The underlying assumption being challenged is that security can remain siloed; instead, it must be integrated across the entire attack lifecycle of autonomous systems.

From the original · Security Affairs (Pierluigi Paganini)

I read the AI security research published in a single month, February 2026, and when you put it all together, it’s not a list of curiosities. It’s a field guide to a new attack surface.

Read the full story at securityaffairs.com

Sentinel — Human

Confidence

The text exhibits strong, focused argumentation supported by domain-specific references and a distinctive voice, suggesting human authorship grounded in specialized knowledge.

Signals Detected

Sentence length variance shows natural variation; strong, thesis-driven phrasing.

Demonstrates deep, consistent argumentative structure linking specific research findings to a broader conceptual model (ATLAS).

Effective use of cited examples (CVEs, study numbers) and transitions that build a cohesive narrative thread.

References to specific research findings (Carlini and Tramèr study, CVE numbers) are embedded in a way consistent with deep domain expertise rather than simple regurgitation.

Human Indicators

Idiosyncratic emphasis on the shift from model behavior to agent behavior is present.

The closing summary relies heavily on prescriptive, high-level calls for discipline (inventory, supply chain treatment) rather than purely descriptive reporting.